CVE-2023-22599

CVE-2023-22599 is a critical vulnerability affecting InHand Networks InRouter 302 (prior to IR302 V3.5.56) and InRouter 615 (prior to InRouter6XX-S-V2.3.0.r5542). It involves the use of a predictable salt with a one-way hash for MQTT credentials, which are sent in response to HTTP/HTTPS requests from the cloud platform. An unauthorized user can easily calculate the hardcoded string used for MD5 hashing, allowing them to spoof requests and potentially disconnect devices or intercept sensitive MQTT communications. With a CVSS score of 9.1 (CRITICAL), this vulnerability has a high severity, indicating it can be exploited remotely with low attack complexity and no user interaction, leading to high impact on confidentiality and availability. The FAUCET Risk Score is 90/100. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite the lack of media coverage, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers.